Yep, thanks -- got directed to this thread. Our spam team was already on it. It is spam, not malware. No one is infected with anything. I think things are already improving and they'll keep debugging it.